{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "add_a_single_event_to_a_sketch.ipynb",
      "provenance": [],
      "include_colab_link": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "view-in-github",
        "colab_type": "text"
      },
      "source": [
        "<a href=\"https://colab.research.google.com/github/google/timesketch/blob/master/notebooks/add_a_single_event_to_a_sketch.ipynb\" target=\"_parent\"><img src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/></a>"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "E2meYbWjdnyR"
      },
      "source": [
        "# Setup\n",
        "\n"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "ZoKUE_mbwOyy",
        "cellView": "form"
      },
      "source": [
        "# @title Install dependencies\n",
        "# @markdown Only execute if not already installed and running a cloud runtime\n",
        "!pip install -q timesketch_api_client\n"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "cFNfts9KNOKi"
      },
      "source": [
        "# @title Import libraries\n",
        "# @markdown This cell will import all the libraries needed for the running of this colab.\n",
        "\n",
        "import altair as alt # For graphing.\n",
        "import numpy as np   # Never know when this will come in handy.\n",
        "import pandas as pd  # We will be using pandas quite heavily.\n",
        "\n",
        "from timesketch_api_client import config"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "_En91RhFQ5l8"
      },
      "source": [
        "# @title Sketch Configuration\n",
        "# @markdown Set the sketch ID for the rest of the notebook\n",
        "\n",
        "Sketch_id = 1 #@param {type:\"integer\"}"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "c_rcGvf2yLvJ"
      },
      "source": [
        "# @title Timesketch connnection\n",
        "ts_client = config.get_client()\n",
        "sketch = ts.get_sketch(Sketch_id)"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "IO_HPkC84muI"
      },
      "source": [
        "# Fill in your event data\n",
        "\n",
        "Put in your message, date and timestamp description"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "fgL9ISpKggQ2"
      },
      "source": [
        "#message: A string that will be used as the message string.  \n",
        "message = \"\" #@param {type:\"string\"}\n",
        "\n",
        "#date: A string with the timestamp of the message. \n",
        "# This should be in a human readable format, eg: \"2020-09-03T22:52:21\". \n",
        "# if empty it will set to now\n",
        "\n",
        "date = \"2020-08-06T12:48:06.994188Z\" #@param {type:\"string\"}\n",
        "\n",
        "#timestamp_desc : Description of the timestamp.  \n",
        "timestamp_desc = \"Test_description\" #@param {type:\"string\"}\n",
        "\n"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "48S5ch1P4s44"
      },
      "source": [
        "# Attributes / Tags (optional)\n",
        "Fill in additional attributes and tags\n",
        "\n",
        "If you do not need that, empty them.\n",
        "\n",
        "## Examples: \n",
        "attributes: A dict of extra attributes to add to the event.  \n",
        "````\n",
        "attributes = {\"a\": \"alpha\", \"o\": \"omega\", \"g\": \"gamma\"}\n",
        "````\n",
        "\n",
        "tags: A list of strings to include as tags.\n",
        "````tags = [\"not\", \"important\"]```` "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "PVoR7JVM42_J"
      },
      "source": [
        "#attributes: A dict of extra attributes to add to the event.  \n",
        "attributes = {\"a\": \"alpha\", \"o\": \"omega\", \"g\": \"gamma\"}\n",
        "\n",
        "#tags: A list of strings to include as tags.\n",
        "tags = [\"not\", \"important\"] "
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "EULXHP4YgZ-S"
      },
      "source": [
        "sketch.add_event(message, date, timestamp_desc, attributes, tags)"
      ],
      "execution_count": null,
      "outputs": []
    }
  ]
}
